Insights
Guides
-
Vendor risk for a 40-person company: what auditors sample and what you can skip
A proportionate third-party program that satisfies CC9.2 and A.5.19 to A.5.23 without a GRC platform.
-
Answering security questionnaires when nobody is the security team
How a 30-person company gets through a 200-row questionnaire without inventing controls, and builds the answer library it will reuse.
-
What a certification auditor reads into your Statement of Applicability
The SoA is the first document a Stage 1 auditor opens and the test plan for Stage 2. How to write one…
-
A SOC 2 readiness review in two weeks, with the tools on this site
The sequence we use before an audit, compressed into ten working days, with the free tools that carry each step.
-
ISO 42001 Explained: What It Is and Who Needs It
ISO/IEC 42001 is the first certifiable standard for AI management systems. Here is what it covers and why customers are starting to…
-
SOC 2 Type I vs. Type II: Which One Do You Need?
Both are SOC 2 reports, but they answer different questions. Here is how to choose, and why many companies do both.
Get The Lightwork Brief
One email a month: framework updates that matter, a practical tip, and what auditors are asking for right now.